2 Commits

Include renames

Author	SHA1	Message	Date
Martin Vogel	93d332d1e0	Fix security audit false positives in CI ... - UI audit (L6): allowlist bundled framework URLs in dist/ (React error URLs, W3C namespace URIs, Three.js credits, Google Fonts, Tailwind). These are embedded by npm deps during Vite build, not our code. - Binary strings (L2): skip URLs shorter than 15 chars — Windows binary has byte sequences that strings(1) interprets as "https://H9" etc. - Allow Google Fonts <link> in HTML (loaded by index.html for Inter/ JetBrains Mono fonts).	2026-03-20 18:47:55 +01:00
Martin Vogel	cd1417427c	Add 8-layer security test suite + hardening ... Code-level defenses: - cbm_validate_shell_arg(): reject shell metacharacters before popen/system - SQLite authorizer: block ATTACH/DETACH at engine level - CORS localhost-only origin reflection (replaces wildcard *) - Path containment: realpath() check in get_code_snippet - process-kill restricted to server-spawned PIDs - SHA256 checksum verification in update command Security audit scripts (8 layers): - L1: Static allow-list for dangerous calls + URLs - L2: Binary string audit (URLs, payloads, credentials) - L3: Network egress monitoring via strace (Linux) - L4: Install output path + content validation - L5: Smoke test hardening (clean shutdown, residual procs) - L6: Graph UI audit (external domains, CORS, binding) - L7: MCP robustness (23 adversarial JSON-RPC payloads) - L8: Vendored integrity (checksums + dangerous call scan) CI: parallel security-static job (no build needed), binary layers in smoke jobs per-platform. Cleanup of test fixture dirs in clean.sh + .gitignore.	2026-03-20 18:19:15 +01:00